Colorado Wrote America’s Toughest AI Law — Then Quietly Repealed It Before It Could Bite
The first state to demand that AI prove it isn’t discriminating against you swapped that duty for a thinner promise: we’ll tell you a machine was involved.
Here’s who that trade actually protects — and who it leaves holding the consequences.
For about two years, I told people that Colorado had done something genuinely brave.
Whenever the conversation turned to AI and the usual despair set in — nobody’s regulating this, the companies write their own rules, the law is hopelessly behind — I had a counterexample ready. One state, I’d say, actually went and did the hard thing. It didn’t just ask companies to be transparent. It told them: if your algorithm decides who gets the job, the loan, the apartment, the insurance policy — you have a duty to make sure it isn’t quietly discriminating, and you have to be able to prove you checked. I was a little proud of that, honestly, the way you get proud of a place you’ve never lived for doing something right.
And then, six weeks before the law was supposed to take effect, Colorado repealed it. Quietly. With the governor who signed the original law cheering the demolition. I want to walk you through exactly what happened — because the way it happened is, I think, a small masterclass in how hard accountability gets swapped for the appearance of it, while almost nobody is looking.
What the law actually demanded (and why the demand was the whole point)
First, the part nobody disputes — the facts of what existed.
In May 2024, Colorado passed the first comprehensive state law in America regulating “high-risk” AI, officially titled “Consumer Protections for Artificial Intelligence.” Forget the legislative number for a second and focus on what it did. If a company used an AI system to make — or to be “a substantial factor in making” — a consequential decision about you (and the law meant the decisions that actually shape a life: employment, housing, lending, insurance, health care, education, legal and government services), that company took on real obligations.
Two of them mattered most. First, a duty of reasonable care: developers and deployers had to “use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination.” Second, the receipts — companies had to run impact assessments and stand up a risk-management program, the paperwork that forces an organization to actually look at whether its model is treating people differently by race or sex, and to write down what it found.
Here is why that combination was the whole ballgame. “Algorithmic discrimination” sounds abstract until you remember that AI doesn’t editorialize — it pattern-matches. Feed a hiring model a decade of a company’s resumes and it learns, with perfect obedience, who that company used to hire. If that history skewed, the model skews, and it does so invisibly, at scale, with a veneer of mathematical neutrality that makes it harder to challenge than a biased human ever was. Colorado’s answer was not “tell people a computer was involved.” It was “you are responsible for the outcome, and you must check your work.” That’s a duty of care. It’s the same principle we apply to a surgeon, an accountant, a bridge engineer — the burden of proof sits with the party that has the power and the information.
That’s the law I’d been bragging about. So what happened to it?
The repeal — and the tell in the timing
On May 14, 2026, Governor Jared Polis signed Senate Bill 26-189 into law, which “repeals and reenacts” the original act with what the lawyers diplomatically call “meaningful changes.” Let me translate “meaningful changes.”
The new law abandons the original’s risk-management and impact-assessment requirements. And — this is the load-bearing one — it eliminates the affirmative duty to prevent algorithmic discrimination entirely. The law firm Crowell & Moring put it about as plainly as a law firm ever will: “three obligations that drove the most concern in the business community are gone” — the risk-management mandate, the impact assessment, and “critically — the duty to use reasonable care to prevent algorithmic discrimination.”
What’s left? A disclosure regime. Companies now have to tell you a machine was involved, and when an automated decision goes against you, they have 30 days to send you a plain-language disclosure explaining the decision and let you ask for human review. The new framework takes effect January 1, 2027.
Now hold those two things next to each other, because the swap is the story. The old law: prove your AI isn’t discriminating. The new law: tell the person after it has. One puts the burden on the company that built and profits from the system. The other puts the burden on you — to notice, to object, to file the appeal, to somehow argue with a “no” whose reasoning lives inside a model you’ll never see.
And here’s the tell. This wasn’t a system that failed and got fixed. The original law’s effective date kept slipping — first February 2026, then pushed to June 30, 2026 — and then it was gutted six weeks before that final date arrived. The toughest AI law in America never enforced a single thing. It was repealed in the crib. That is not “we tried it and it didn’t work.” That is “we made sure it never got the chance to.”
This is what I’ve come to call the bait-and-switch of modern tech governance: the headline promises accountability, the fine print delivers notice, and the gap between those two words is exactly where your protection used to live.
“But the law was a mess” — taking the other side seriously
Now, to be clear, I don’t want to strawman the people who killed this thing, because some of their argument is real and deserves a fair hearing.
The honest case against the original law goes like this: it was vague, sprawling, and genuinely hard to comply with. “Reasonable care to avoid algorithmic discrimination” is a beautiful phrase and a compliance nightmare — what, precisely, does reasonable mean when you’re a forty-person startup, not Google? The impact-assessment paperwork was heavy. And critics argued it could backfire: that forcing companies to scrub every “differential impact” might push them to fiddle with outputs in ways that make the AI less accurate, not less biased.
This isn’t a fringe complaint. It came from the top. Even Governor Polis, when he signed the original bill, warned it created what he called a “complex compliance regime” that ought to be slimmed down. So this wasn’t a clean fight between consumer champions and corporate villains. It was a genuinely hard problem — how do you regulate a technology that’s a moving target, without crushing the small players or freezing the thing in place? — and reasonable people landed in different spots.
So let me grant the strongest version: yes, the original law was imperfect, and yes, vague duties are a real cost.
But here is where I get off the train. When a rule is too vague, you sharpen it. When it’s too heavy for small players, you add thresholds and safe harbors. You don’t delete the duty. The fix for “prove you’re not discriminating is hard to define” is to define it better — not to replace it with “send a letter afterward.” We didn’t respond to messy food-safety rules by abolishing the idea that restaurants are responsible for not poisoning you. The complexity was an argument for a better law. It got used as an argument for a thinner one. That substitution — real problem, convenient solution, wrong direction — is the move to watch.
The part Colorado isn’t saying out loud
Here is where things get interesting, because Colorado did not gut its law in a vacuum. It did it under a very specific, very loud kind of pressure — and once you see the pressure, the “complex compliance” explanation starts to look like the polite version of events.
In December 2025, the White House issued a sweeping executive order declaring that “State-by-State regulation by definition creates a patchwork of 50 different regulatory regimes” that slows American AI. It named Colorado by name, warning that “a new Colorado law banning ‘algorithmic discrimination’ may even force AI models to produce false results.” And it didn’t stop at rhetoric: the order directed the Attorney General to “establish an AI Litigation Task Force whose sole responsibility shall be to challenge State AI laws.” Legal analysts at Gibson Dunn read it exactly as written — the order calls out Colorado’s AI Act as an example of a problematic state law and stands up a task force to go after laws like it.
That was the rhetoric. Then came the lawsuit. In April 2026, the Justice Department moved to intervene in a suit by Elon Musk’s xAI “challenging a new Colorado law that prohibits so-called ‘algorithmic discrimination.’” The framing was incendiary: “Laws that require AI companies to infect their products with woke DEI ideology are illegal,” said the Assistant Attorney General running the Civil Rights Division. Read that twice. The Civil Rights Division — the part of the federal government built to fight discrimination — was suing to strike down a state’s attempt to prevent it, on the theory that requiring companies to check for disparate impact is itself the offense.
So picture Colorado’s position in the spring of 2026. Your landmark law is being sued. The federal Justice Department has joined the other side. The President has personally named you in an executive order and pointed a litigation task force at your statute. Repealing the law you can no longer afford to defend, and calling it “reducing compliance burdens,” starts to look less like a policy epiphany and more like a quiet surrender — dressed up as housekeeping.
Now imagine the next few years
Let me get a little speculative, because the trajectory here is not subtle.
Picture 2028. The disclosure regime is humming along exactly as designed. You apply for an apartment and get declined; a tidy, well-written, 30-day letter informs you that an automated system “was a factor” and invites you to request human review. You do. A human glances at the same score the machine produced, shrugs, and affirms it. You apply for a small-business loan — same letter. A job — same letter. You are being informed, beautifully, at every turn. You are also being quietly, consistently sorted, and there is no one whose legal job it was to check whether the sorting was fair before it reached you. The duty to look — the thing that might have caught the pattern — was repealed in 2026. All that survived was the duty to notify.
Now zoom out. If the federal task force succeeds and the courts agree that requiring companies to prevent discriminatory outcomes is itself unconstitutional, the lesson every other state learns is brutal and simple: don’t bother. Pass a notice law if you must — disclosure is cheap and litigation-proof — but never again attach a duty of care to an algorithm. We would back into a national rule that no one ever voted for: AI gets to make the most consequential decisions in your life, and the only enforceable obligation is to tell you it did. The most powerful decision-making technology in human history, governed like a parking sign.
That’s not a dystopia of killer robots. It’s something quieter and more likely — a world where accountability for machines is defined down to a polite heads-up.
What the smart people are saying
The encouraging news is that this is a genuinely contested question, and serious voices across the spectrum are still arguing it out — which means the door isn’t shut.
On one side, the case against the patchwork is real and not merely partisan. The right-leaning American Enterprise Institute notes that in 2025 alone state legislatures considered more than 1,000 AI-related bills — a genuinely chaotic landscape for any company trying to operate in all fifty states. And it’s not just the right who notices the mess: researchers at the center-left Brookings Institution document how complex, ambitious state bills produce real stakeholder fragmentation, with most never even becoming law. The desire for one coherent national rule instead of fifty contradictory ones is legitimate. I share it.
But — and this is the crux — “we need one good national rule” and “so let’s delete the state rules first and hope a federal one shows up” are very different propositions. And on that, the consumer side is blunt. Privacy advocates at EPIC warned that the repeal removes many important safety and testing requirements — naming the duty of care, the risk-management programs, the impact assessments, the reporting to the Attorney General — and leaves people with notice and little else. Their point: you don’t fix fragmentation by demolishing the strongest protection and replacing it with nothing.
And lest anyone think the states are eager to surrender, remember what happened the last time Washington tried to clear the field by force. In July 2025, the U.S. Senate voted 99-1 to strip a ten-year moratorium on state AI regulation out of the budget bill. Ninety-nine to one — in a Senate that agrees on essentially nothing. The appetite to preempt state protections exists. So does a near-unanimous instinct to defend them. Colorado just happens to be the place where, this year, the second instinct lost.
What does this mean for you?
You don’t live in Colorado? It doesn’t matter. Colorado is the test case, and test cases set the template. Here’s how to think about it where you are:
Stop accepting “an automated system was involved” as the end of the conversation. It’s the beginning. When a consequential “no” arrives — a loan, a job, an apartment, an insurance rate — ask the question disclosure can’t answer for you: what was checked to make sure this wasn’t biased? Make them say “nothing” out loud.
Use the appeal, even when it feels pointless. Notice-and-appeal regimes only have teeth if people actually pull the lever. A human-review request that goes nowhere is still a record that the system was challenged — and volume is what turns a dead-letter right into a real one.
Watch your own state’s bill numbers. When a politician sells a new “AI transparency” or “AI consumer” law, read one level down: does it impose a duty on the company, or just a disclosure to you? That single distinction is the difference between protection and paperwork.
Don’t let “fragmentation” become the magic word that ends every debate. Yes, fifty different rules is messy. But “it’s complicated” is not a reason to have no enforceable rule — it’s a reason to demand a good one. Notice the people using complexity as a lever to lower the bar.
Keep your own receipts. Screenshot the decision, save the letter, note the date. In a world that’s offloading judgment to systems no one will explain, your own documentation may be the only evidence that survives.
The lesson, as I see it
I’ll be honest: I’m not against a single, sane national AI framework. Fifty legislatures improvising in fifty directions is a real problem, and the people who say so aren’t wrong. If Washington wants to write one strong, clear rule that protects people coast to coast, I’m first in line to cheer it.
But that is not what happened in Colorado. What happened is that the toughest accountability law in the country was killed before it could protect a single person, under federal pressure, and the void was filled not with a better rule but with a thinner one — a duty to notify standing in for a duty to not harm. The promise was that AI would have to answer for what it does to people. The delivery was a form letter.
So my vote? Refuse the swap. Hold the line that a machine making a decision about your life is something a human being remains responsible for — not just required to mention. Disclosure is the floor, not the achievement. The day we let “we told you a computer did it” become a complete answer is the day we stop being citizens with rights and start being users with notifications. Colorado just showed us how fast that line can move. The least we can do is notice it moving — and say so, loudly, while saying so still counts.
The HAIA Foundation exists to keep human judgment — and human responsibility — at the center of how we govern intelligent machines. If this clarified something for you, that’s the whole point: pass it to someone who’s about to shrug off an “automated decision” notice, and ask them the question the fine print won’t. More of these at the HAIA Foundation and on our Substack.